import ForbiddenError from '@/shared/errors/forbidden';
import type { CurrentUser } from '@/db/api/types';

/**
 * Download authorization. Per-file tenant/ownership enforcement was **removed**
 * (customer decision): downloads now require only a valid authenticated session
 * (JWT), not per-file organization ownership. This unblocks the logo/avatar/
 * document upload+download flow, whose standalone `/file/upload/:table/:field`
 * path does not create a tracked `file` row.
 *
 * Trade-off: any authenticated user can fetch a file by its `privateUrl` path,
 * including across organizations. Accepted by the customer for this stage.
 */
export async function assertCanDownloadFile(
  _privateUrl: string,
  currentUser?: CurrentUser,
): Promise<void> {
  if (!currentUser?.id) {
    throw new ForbiddenError();
  }
}
